@jait/gateway 0.1.0

package/dist/security/trust-engine.js

@@ -0,0 +1,192 @@
+/**
+ * Trust Level Engine — Sprint 4.4
+ *
+ * Tracks per-action-type trust progression Level 0→3:
+ *
+ *   Level 0 — Observer:   everything requires consent
+ *   Level 1 — Assisted:   low-risk ops auto-execute
+ *   Level 2 — Trusted:    "once" consent ops auto-execute after first approval
+ *   Level 3 — Autopilot:  "always" consent ops also auto-execute
+ *
+ * Trust increases after consecutive successful approved actions.
+ * Trust decreases (revert) when actions are rolled back or fail dangerously.
+ *
+ * Thresholds:
+ *   Level 0 → 1:  3 approved actions
+ *   Level 1 → 2:  10 approved actions (cumulative)
+ *   Level 2 → 3:  25 approved actions (cumulative)
+ *
+ * Any revert drops one level and resets the revert counter.
+ */
+import { trustLevels } from "../db/schema.js";
+import { eq } from "drizzle-orm";
+// ── Thresholds ───────────────────────────────────────────────────────
+const LEVEL_THRESHOLDS = [
+    0, // Level 0: default
+    3, // Level 1: 3 approved
+    10, // Level 2: 10 approved
+    25, // Level 3: 25 approved
+];
+// ── TrustEngine ──────────────────────────────────────────────────────
+export class TrustEngine {
+    db;
+    cache = new Map();
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Get the current trust level for an action type.
+     */
+    getLevel(actionType) {
+        return this.getState(actionType).currentLevel;
+    }
+    /**
+     * Get the full trust state for an action type.
+     */
+    getState(actionType) {
+        // Check cache first
+        const cached = this.cache.get(actionType);
+        if (cached)
+            return cached;
+        // Load from DB
+        if (this.db) {
+            const row = this.db
+                .select()
+                .from(trustLevels)
+                .where(eq(trustLevels.actionType, actionType))
+                .get();
+            if (row) {
+                const state = {
+                    actionType,
+                    approvedCount: row.approvedCount ?? 0,
+                    revertedCount: row.revertedCount ?? 0,
+                    currentLevel: clampLevel(row.currentLevel ?? 0),
+                };
+                this.cache.set(actionType, state);
+                return state;
+            }
+        }
+        // Default: Level 0
+        const defaultState = {
+            actionType,
+            approvedCount: 0,
+            revertedCount: 0,
+            currentLevel: 0,
+        };
+        this.cache.set(actionType, defaultState);
+        return defaultState;
+    }
+    /**
+     * Record a successful approved action. May increase trust level.
+     * Returns the new trust state.
+     */
+    recordApproval(actionType) {
+        const state = this.getState(actionType);
+        state.approvedCount += 1;
+        // Check if we should level up
+        const newLevel = computeLevel(state.approvedCount);
+        if (newLevel > state.currentLevel) {
+            state.currentLevel = newLevel;
+        }
+        this.persist(state);
+        return state;
+    }
+    /**
+     * Record a revert / dangerous failure. Drops one level.
+     * Returns the new trust state.
+     */
+    recordRevert(actionType) {
+        const state = this.getState(actionType);
+        state.revertedCount += 1;
+        // Drop one level (minimum 0)
+        if (state.currentLevel > 0) {
+            state.currentLevel = (state.currentLevel - 1);
+        }
+        this.persist(state);
+        return state;
+    }
+    /**
+     * Reset trust for an action type back to Level 0.
+     */
+    reset(actionType) {
+        const state = {
+            actionType,
+            approvedCount: 0,
+            revertedCount: 0,
+            currentLevel: 0,
+        };
+        this.cache.set(actionType, state);
+        this.persist(state);
+        return state;
+    }
+    /**
+     * Get all tracked trust states.
+     */
+    listAll() {
+        if (!this.db)
+            return [...this.cache.values()];
+        const rows = this.db.select().from(trustLevels).all();
+        return rows.map((row) => ({
+            actionType: row.actionType,
+            approvedCount: row.approvedCount ?? 0,
+            revertedCount: row.revertedCount ?? 0,
+            currentLevel: clampLevel(row.currentLevel ?? 0),
+        }));
+    }
+    // ── Internal ─────────────────────────────────────────────────────
+    persist(state) {
+        this.cache.set(state.actionType, state);
+        if (!this.db)
+            return;
+        try {
+            // Upsert: try insert, on conflict update
+            const existing = this.db
+                .select()
+                .from(trustLevels)
+                .where(eq(trustLevels.actionType, state.actionType))
+                .get();
+            if (existing) {
+                this.db
+                    .update(trustLevels)
+                    .set({
+                    approvedCount: state.approvedCount,
+                    revertedCount: state.revertedCount,
+                    currentLevel: state.currentLevel,
+                })
+                    .where(eq(trustLevels.actionType, state.actionType))
+                    .run();
+            }
+            else {
+                this.db.insert(trustLevels).values({
+                    actionType: state.actionType,
+                    approvedCount: state.approvedCount,
+                    revertedCount: state.revertedCount,
+                    currentLevel: state.currentLevel,
+                }).run();
+            }
+        }
+        catch {
+            // Non-fatal: in-memory cache is source of truth during session
+        }
+    }
+}
+// ── Helpers ──────────────────────────────────────────────────────────
+function computeLevel(approvedCount) {
+    if (approvedCount >= LEVEL_THRESHOLDS[3])
+        return 3;
+    if (approvedCount >= LEVEL_THRESHOLDS[2])
+        return 2;
+    if (approvedCount >= LEVEL_THRESHOLDS[1])
+        return 1;
+    return 0;
+}
+function clampLevel(n) {
+    if (n >= 3)
+        return 3;
+    if (n >= 2)
+        return 2;
+    if (n >= 1)
+        return 1;
+    return 0;
+}
+//# sourceMappingURL=trust-engine.js.map

package/dist/security/trust-engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-engine.js","sourceRoot":"","sources":["../../src/security/trust-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,wEAAwE;AAExE,MAAM,gBAAgB,GAAsB;IAC1C,CAAC,EAAI,mBAAmB;IACxB,CAAC,EAAI,sBAAsB;IAC3B,EAAE,EAAG,uBAAuB;IAC5B,EAAE,EAAG,uBAAuB;CAC7B,CAAC;AAWF,wEAAwE;AAExE,MAAM,OAAO,WAAW;IAGO;IAFrB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,YAA6B,EAAW;QAAX,OAAE,GAAF,EAAE,CAAS;IAAG,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,UAAkB;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,UAAkB;QACzB,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,eAAe;QACf,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;iBAChB,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;iBAC7C,GAAG,EAAE,CAAC;YAET,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,KAAK,GAAe;oBACxB,UAAU;oBACV,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;oBACrC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;oBACrC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;iBAChD,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,MAAM,YAAY,GAAe;YAC/B,UAAU;YACV,aAAa,EAAE,CAAC;YAChB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACzC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,UAAkB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;QAEzB,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,QAAQ,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YAClC,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,UAAkB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;QAEzB,6BAA6B;QAC7B,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAe,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAkB;QACtB,MAAM,KAAK,GAAe;YACxB,UAAU;YACV,aAAa,EAAE,CAAC;YAChB,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,CAAC;SAChB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;YACrC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;YACrC,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;SAChD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,oEAAoE;IAE5D,OAAO,CAAC,KAAiB;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAExC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO;QAErB,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;iBACrB,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;iBACnD,GAAG,EAAE,CAAC;YAET,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,EAAE;qBACJ,MAAM,CAAC,WAAW,CAAC;qBACnB,GAAG,CAAC;oBACH,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;qBACD,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;qBACnD,GAAG,EAAE,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;oBACjC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC,CAAC,GAAG,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;CACF;AAED,wEAAwE;AAExE,SAAS,YAAY,CAAC,aAAqB;IACzC,IAAI,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAE;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAE;QAAE,OAAO,CAAC,CAAC;IACpD,IAAI,aAAa,IAAI,gBAAgB,CAAC,CAAC,CAAE;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,54 @@
+import Fastify from "fastify";
+import type { AppConfig } from "./config.js";
+import type { SessionService } from "./services/sessions.js";
+import type { AuditWriter } from "./services/audit.js";
+import type { SurfaceRegistry } from "./surfaces/index.js";
+import type { ToolRegistry } from "./tools/registry.js";
+import type { ToolContext, ToolResult } from "./tools/contracts.js";
+import type { ConsentManager } from "./security/consent-manager.js";
+import type { TrustEngine } from "./security/trust-engine.js";
+import type { JaitDB } from "./db/index.js";
+import type { WsControlPlane } from "./ws.js";
+import type { HookBus } from "./scheduler/hooks.js";
+import type { SchedulerService } from "./scheduler/service.js";
+import type { MemoryService } from "./memory/contracts.js";
+import type { UserService } from "./services/users.js";
+import type { DeviceRegistry } from "./services/device-registry.js";
+import type { VoiceService } from "./voice/service.js";
+import type { ScreenShareService } from "@jait/screen-share";
+import type { SessionStateService } from "./services/session-state.js";
+import type { ThreadService } from "./services/threads.js";
+import type { RepositoryService } from "./services/repositories.js";
+import type { ProviderRegistry } from "./providers/registry.js";
+import type { Database } from "bun:sqlite";
+export interface ServerDeps {
+    db?: JaitDB;
+    sqlite?: Database;
+    sessionService?: SessionService;
+    userService?: UserService;
+    audit?: AuditWriter;
+    surfaceRegistry?: SurfaceRegistry;
+    toolRegistry?: ToolRegistry;
+    consentManager?: ConsentManager;
+    trustEngine?: TrustEngine;
+    ws?: WsControlPlane;
+    hooks?: HookBus;
+    scheduler?: SchedulerService;
+    hookSecret?: string;
+    onWakeHook?: () => Promise<unknown>;
+    onAgentHook?: (payload: unknown) => Promise<unknown>;
+    memoryService?: MemoryService;
+    deviceRegistry?: DeviceRegistry;
+    sessionState?: SessionStateService;
+    toolExecutor?: (toolName: string, input: unknown, context: ToolContext, options?: {
+        dryRun?: boolean;
+        consentTimeoutMs?: number;
+    }) => Promise<ToolResult>;
+    voiceService?: VoiceService;
+    screenShare?: ScreenShareService;
+    threadService?: ThreadService;
+    repoService?: RepositoryService;
+    providerRegistry?: ProviderRegistry;
+}
+export declare function createServer(config: AppConfig, deps?: ServerDeps): Promise<Fastify.FastifyInstance<import("http").Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, Fastify.FastifyBaseLogger, Fastify.FastifyTypeProviderDefault>>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAO9B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAuB7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,YAAY,CAAC,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,KACtD,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,GAAE,UAAe,sSA4I1E"}

package/dist/server.js

@@ -0,0 +1,188 @@
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import fastifyStatic from "@fastify/static";
+import { existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { VERSION } from "@jait/shared";
+const __dirname = dirname(fileURLToPath(import.meta.url));
+import { registerChatRoutes } from "./routes/chat.js";
+import { registerHealthRoutes } from "./routes/health.js";
+import { registerSessionRoutes } from "./routes/sessions.js";
+import { registerAuthRoutes } from "./routes/auth.js";
+import { registerTerminalRoutes } from "./routes/terminals.js";
+import { registerConsentRoutes } from "./routes/consent.js";
+import { registerTrustRoutes } from "./routes/trust.js";
+import { registerHookRoutes } from "./routes/hooks.js";
+import { registerJobRoutes } from "./routes/jobs.js";
+import { registerMobileRoutes } from "./routes/mobile.js";
+import { registerNetworkRoutes } from "./routes/network.js";
+import { registerVoiceRoutes } from "./routes/voice.js";
+import { registerWorkspaceRoutes } from "./routes/workspace.js";
+import { registerScreenShareRoutes } from "./routes/screen-share.js";
+import { registerFilesystemRoutes } from "./routes/filesystem.js";
+import { registerThreadRoutes } from "./routes/threads.js";
+import { registerRepoRoutes } from "./routes/repositories.js";
+import { registerMcpRoutes } from "./routes/mcp-server.js";
+import { registerGitRoutes } from "./routes/git.js";
+import { getSchemaVersion } from "./db/connection.js";
+export async function createServer(config, deps = {}) {
+    const app = Fastify({
+        logger: {
+            level: config.logLevel,
+        },
+    });
+    await app.register(cors, {
+        origin: true, // allow any origin — auth is JWT-based, not origin-based
+        methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
+    });
+    registerHealthRoutes(app, config, {
+        getDeviceCount: () => deps.deviceRegistry?.count() ?? 0,
+        getSchemaVersion: () => deps.sqlite ? getSchemaVersion(deps.sqlite) : 0,
+    });
+    if (deps.userService) {
+        registerAuthRoutes(app, config, deps.userService, deps.toolRegistry);
+    }
+    registerChatRoutes(app, config, {
+        db: deps.db,
+        sessionService: deps.sessionService,
+        toolRegistry: deps.toolRegistry,
+        surfaceRegistry: deps.surfaceRegistry,
+        audit: deps.audit,
+        toolExecutor: deps.toolExecutor,
+        memoryService: deps.memoryService,
+        userService: deps.userService,
+        ws: deps.ws,
+        sessionState: deps.sessionState,
+        providerRegistry: deps.providerRegistry,
+    });
+    if (deps.sessionService && deps.audit) {
+        registerSessionRoutes(app, config, deps.sessionService, deps.audit, deps.hooks, deps.sessionState);
+    }
+    if (deps.surfaceRegistry && deps.toolRegistry && deps.audit) {
+        registerTerminalRoutes(app, deps.surfaceRegistry, deps.toolRegistry, deps.audit, deps.toolExecutor);
+    }
+    if (deps.consentManager && deps.audit) {
+        registerConsentRoutes(app, deps.consentManager, deps.audit);
+    }
+    if (deps.voiceService && deps.consentManager) {
+        registerVoiceRoutes(app, deps.voiceService, deps.consentManager);
+    }
+    if (deps.trustEngine) {
+        registerTrustRoutes(app, deps.trustEngine);
+    }
+    if (deps.hooks && deps.hookSecret && deps.onWakeHook && deps.onAgentHook) {
+        registerHookRoutes(app, {
+            hooks: deps.hooks,
+            hookSecret: deps.hookSecret,
+            onWake: deps.onWakeHook,
+            onAgentHook: deps.onAgentHook,
+        });
+    }
+    if (deps.scheduler) {
+        registerJobRoutes(app, config, deps.scheduler);
+    }
+    if (deps.deviceRegistry && deps.consentManager) {
+        registerMobileRoutes(app, {
+            deviceRegistry: deps.deviceRegistry,
+            consentManager: deps.consentManager,
+            sessionService: deps.sessionService,
+        });
+    }
+    registerNetworkRoutes(app);
+    if (deps.screenShare && deps.ws) {
+        registerScreenShareRoutes(app, { screenShare: deps.screenShare, ws: deps.ws });
+    }
+    registerFilesystemRoutes(app, deps.ws);
+    if (deps.surfaceRegistry) {
+        registerWorkspaceRoutes(app, deps.surfaceRegistry, deps.sessionState, deps.sessionService);
+    }
+    // Git API routes
+    registerGitRoutes(app, config);
+    // Agent threads + provider routes
+    if (deps.threadService && deps.providerRegistry) {
+        registerThreadRoutes(app, config, {
+            threadService: deps.threadService,
+            providerRegistry: deps.providerRegistry,
+            userService: deps.userService,
+            ws: deps.ws,
+        });
+    }
+    // Automation repository routes
+    if (deps.repoService) {
+        registerRepoRoutes(app, config, {
+            repoService: deps.repoService,
+            ws: deps.ws,
+        });
+    }
+    // MCP SSE server for external CLI agents
+    if (deps.toolRegistry) {
+        registerMcpRoutes(app, { toolRegistry: deps.toolRegistry, config });
+    }
+    // ── Serve the web frontend (SPA) if the built files exist ────────
+    // Probe paths in order: JAIT_WEB_DIR env, co-located ../web/dist
+    // (npm global install or Docker), monorepo apps/web/dist (dev)
+    const webDir = resolveWebDir();
+    if (webDir) {
+        await app.register(fastifyStatic, {
+            root: webDir,
+            prefix: "/",
+            decorateReply: false,
+            // Don't serve index.html for API routes
+        });
+        // SPA fallback — serve index.html for any non-API, non-file GET
+        app.setNotFoundHandler(async (request, reply) => {
+            if (request.method === "GET" && !request.url.startsWith("/api") && !request.url.startsWith("/health")) {
+                const indexPath = join(webDir, "index.html");
+                const html = await readFile(indexPath, "utf8");
+                return reply.type("text/html").send(html);
+            }
+            return reply.status(404).send({ error: "Not Found" });
+        });
+        console.log(`Serving web UI from ${webDir}`);
+    }
+    else {
+        app.get("/", async () => ({
+            name: "jait-gateway",
+            version: VERSION,
+            status: "ok",
+        }));
+    }
+    return app;
+}
+/** Resolve the directory containing the built web frontend. */
+function resolveWebDir() {
+    // 1. Explicit env override
+    if (process.env["JAIT_WEB_DIR"] && existsSync(process.env["JAIT_WEB_DIR"])) {
+        return process.env["JAIT_WEB_DIR"];
+    }
+    // 2. Probe known locations for @jait/web/dist
+    const candidates = [
+        // npm global install: node_modules/@jait/web/dist (relative to gateway dist/)
+        join(__dirname, "../../web/dist"),
+        // If @jait/web is hoisted into top-level node_modules
+        join(__dirname, "../../../@jait/web/dist"),
+        // Try require.resolve to find @jait/web regardless of hoist layout
+        (() => {
+            try {
+                // Resolve @jait/web package.json, then look for dist/ next to it
+                const webPkg = require.resolve("@jait/web/package.json", { paths: [__dirname, process.cwd()] });
+                return join(dirname(webPkg), "dist");
+            }
+            catch {
+                return null;
+            }
+        })(),
+        // Monorepo dev layout
+        join(__dirname, "../../../../apps/web/dist"),
+        // Manual placement in CWD
+        join(process.cwd(), "web-dist"),
+    ].filter((c) => c !== null);
+    for (const dir of candidates) {
+        if (existsSync(join(dir, "index.html")))
+            return dir;
+    }
+    return null;
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,eAAe,CAAC;AACjC,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAsBpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAkCtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAiB,EAAE,OAAmB,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE;YACN,KAAK,EAAE,MAAM,CAAC,QAAQ;SACvB;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,yDAAyD;QACvE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;KAC9D,CAAC,CAAC;IAEH,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE;QAChC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC;QACvD,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KACxE,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IACD,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE;QAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACtG,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACzE,kBAAkB,CAAC,GAAG,EAAE;YACtB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,oBAAoB,CAAC,GAAG,EAAE;YACxB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAChC,yBAAyB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7F,CAAC;IAED,iBAAiB;IACjB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAE/B,kCAAkC;IAClC,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE;YAChC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE;YAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,iBAAiB,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE;YAChC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,GAAG;YACX,aAAa,EAAE,KAAK;YACpB,wCAAwC;SACzC,CAAC,CAAC;QAEH,gEAAgE;QAChE,GAAG,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtG,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC,CAAC;IACN,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa;IACpB,2BAA2B;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QAC3E,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrC,CAAC;IACD,8CAA8C;IAC9C,MAAM,UAAU,GAAG;QACjB,8EAA8E;QAC9E,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC;QACjC,sDAAsD;QACtD,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC;QAC1C,mEAAmE;QACnE,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;QAC1B,CAAC,CAAC,EAAE;QACJ,sBAAsB;QACtB,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC;QAC5C,0BAA0B;QAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/audit.d.ts

@@ -0,0 +1,60 @@
+import type { JaitDB } from "../db/connection.js";
+export interface AuditEntry {
+    sessionId?: string;
+    surfaceType?: string;
+    deviceId?: string;
+    actionId: string;
+    actionType: string;
+    toolName?: string;
+    inputs?: unknown;
+    outputs?: unknown;
+    sideEffects?: unknown;
+    parentActionId?: string;
+    status: string;
+    consentMethod?: string;
+}
+export declare class AuditWriter {
+    private db;
+    constructor(db: JaitDB);
+    /** Write a new audit log entry. Returns the entry's id. */
+    write(entry: AuditEntry): string;
+    /** Check if an action ID already exists (idempotency guard). */
+    hasAction(actionId: string): boolean;
+    /** Get all audit entries for a session, newest first. */
+    getBySession(sessionId: string): {
+        id: string;
+        timestamp: string;
+        sessionId: string | null;
+        surfaceType: string | null;
+        deviceId: string | null;
+        actionId: string | null;
+        actionType: string | null;
+        toolName: string | null;
+        inputs: string | null;
+        outputs: string | null;
+        sideEffects: string | null;
+        signature: string | null;
+        parentActionId: string | null;
+        status: string | null;
+        consentMethod: string | null;
+    }[];
+    /** Get all audit entries (newest first). */
+    getAll(): {
+        id: string;
+        timestamp: string;
+        sessionId: string | null;
+        surfaceType: string | null;
+        deviceId: string | null;
+        actionId: string | null;
+        actionType: string | null;
+        toolName: string | null;
+        inputs: string | null;
+        outputs: string | null;
+        sideEffects: string | null;
+        signature: string | null;
+        parentActionId: string | null;
+        status: string | null;
+        consentMethod: string | null;
+    }[];
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/services/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/services/audit.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,WAAW;IACV,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,MAAM;IAE9B,2DAA2D;IAC3D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAyBhC,gEAAgE;IAChE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IASpC,yDAAyD;IACzD,YAAY,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;IAS9B,4CAA4C;IAC5C,MAAM;;;;;;;;;;;;;;;;;CAGP"}

package/dist/services/audit.js

@@ -0,0 +1,58 @@
+/**
+ * Audit log writer — records every tool call / action to SQLite.
+ */
+import { eq } from "drizzle-orm";
+import { auditLog } from "../db/schema.js";
+import { uuidv7 } from "../lib/uuidv7.js";
+export class AuditWriter {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /** Write a new audit log entry. Returns the entry's id. */
+    write(entry) {
+        const id = uuidv7();
+        const now = new Date().toISOString();
+        this.db.insert(auditLog).values({
+            id,
+            timestamp: now,
+            sessionId: entry.sessionId ?? null,
+            surfaceType: entry.surfaceType ?? null,
+            deviceId: entry.deviceId ?? null,
+            actionId: entry.actionId,
+            actionType: entry.actionType,
+            toolName: entry.toolName ?? null,
+            inputs: entry.inputs ? JSON.stringify(entry.inputs) : null,
+            outputs: entry.outputs ? JSON.stringify(entry.outputs) : null,
+            sideEffects: entry.sideEffects ? JSON.stringify(entry.sideEffects) : null,
+            signature: null,
+            parentActionId: entry.parentActionId ?? null,
+            status: entry.status,
+            consentMethod: entry.consentMethod ?? null,
+        }).run();
+        return id;
+    }
+    /** Check if an action ID already exists (idempotency guard). */
+    hasAction(actionId) {
+        const row = this.db
+            .select({ id: auditLog.id })
+            .from(auditLog)
+            .where(eq(auditLog.actionId, actionId))
+            .get();
+        return row !== undefined;
+    }
+    /** Get all audit entries for a session, newest first. */
+    getBySession(sessionId) {
+        return this.db
+            .select()
+            .from(auditLog)
+            .where(eq(auditLog.sessionId, sessionId))
+            .orderBy(auditLog.timestamp)
+            .all();
+    }
+    /** Get all audit entries (newest first). */
+    getAll() {
+        return this.db.select().from(auditLog).orderBy(auditLog.timestamp).all();
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/services/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/services/audit.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB1C,MAAM,OAAO,WAAW;IACF;IAApB,YAAoB,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IAElC,2DAA2D;IAC3D,KAAK,CAAC,KAAiB;QACrB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YAC9B,EAAE;YACF,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1D,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7D,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;YACzE,SAAS,EAAE,IAAI;YACf,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;SAC3C,CAAC,CAAC,GAAG,EAAE,CAAC;QAET,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gEAAgE;IAChE,SAAS,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aAChB,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;aAC3B,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACtC,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;aACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;aAC3B,GAAG,EAAE,CAAC;IACX,CAAC;IAED,4CAA4C;IAC5C,MAAM;QACJ,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/services/device-registry.d.ts

@@ -0,0 +1,15 @@
+import type { DeviceInfo } from "@jait/shared";
+export interface RegisterDeviceInput {
+    id: string;
+    name: string;
+    platform: DeviceInfo["platform"];
+    capabilities: string[];
+}
+export declare class DeviceRegistry {
+    private readonly devices;
+    register(input: RegisterDeviceInput): DeviceInfo;
+    heartbeat(deviceId: string): DeviceInfo | null;
+    list(): DeviceInfo[];
+    count(): number;
+}
+//# sourceMappingURL=device-registry.d.ts.map

package/dist/services/device-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-registry.d.ts","sourceRoot":"","sources":["../../src/services/device-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU;IAehD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAQ9C,IAAI,IAAI,UAAU,EAAE;IAIpB,KAAK,IAAI,MAAM;CAGhB"}

package/dist/services/device-registry.js

@@ -0,0 +1,32 @@
+export class DeviceRegistry {
+    devices = new Map();
+    register(input) {
+        const now = new Date().toISOString();
+        const existing = this.devices.get(input.id);
+        const next = {
+            id: input.id,
+            name: input.name,
+            platform: input.platform,
+            capabilities: [...new Set(input.capabilities)],
+            connectedAt: existing?.connectedAt ?? now,
+            lastSeen: now,
+        };
+        this.devices.set(input.id, next);
+        return next;
+    }
+    heartbeat(deviceId) {
+        const existing = this.devices.get(deviceId);
+        if (!existing)
+            return null;
+        const next = { ...existing, lastSeen: new Date().toISOString() };
+        this.devices.set(deviceId, next);
+        return next;
+    }
+    list() {
+        return [...this.devices.values()].sort((a, b) => b.lastSeen.localeCompare(a.lastSeen));
+    }
+    count() {
+        return this.devices.size;
+    }
+}
+//# sourceMappingURL=device-registry.js.map

package/dist/services/device-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-registry.js","sourceRoot":"","sources":["../../src/services/device-registry.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,QAAQ,CAAC,KAA0B;QACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC9C,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,GAAG;YACzC,QAAQ,EAAE,GAAG;SACd,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAe,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}